From b31ce69722c654e9167b34f0d1b3f55e21f22604 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 29 Jun 2026 14:03:45 +0200 Subject: [PATCH] eap-ttls: Add an upper bound for the length of the parsed AVP On typical systems that have overcommitting enabled, the 16 MiB maximum that's allocated via the 24-bit length field in the AVP header shouldn't be an issue as there are various limits that affect how much data can actually be written to the allocated buffer (e.g. the maximum IKE message size, the maximum TLS record size, or the maximum number of accepted EAP-TTLS payloads), so this is primarily a defense-in-depth measure. The length field of an EAP payload, which is the only type of AVP we accept, is 16 bits, so that's what we now enforce as maximum. --- src/libcharon/plugins/eap_ttls/eap_ttls_avp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_avp.c b/src/libcharon/plugins/eap_ttls/eap_ttls_avp.c index 2983bd021..36778de16 100644 --- a/src/libcharon/plugins/eap_ttls/eap_ttls_avp.c +++ b/src/libcharon/plugins/eap_ttls/eap_ttls_avp.c @@ -20,6 +20,7 @@ #define AVP_EAP_MESSAGE 79 #define AVP_HEADER_LEN 8 +#define AVP_LENGTH_MAX UINT16_MAX typedef struct private_eap_ttls_avp_t private_eap_ttls_avp_t; @@ -119,7 +120,7 @@ METHOD(eap_ttls_avp_t, process, status_t, chunk_free(&this->input); this->inpos = 0; - if (!success || avp_len < AVP_HEADER_LEN) + if (!success || avp_len < AVP_HEADER_LEN || avp_len > AVP_LENGTH_MAX) { DBG1(DBG_IKE, "received invalid AVP header"); return FAILED;